<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>双Token无感刷新：让用户永不掉线的终极方案</title>
    <link href="https://cdn.staticfile.org/font-awesome/6.4.0/css/all.min.css" rel="stylesheet">
    <link href="https://cdn.staticfile.org/tailwindcss/2.2.19/tailwind.min.css" rel="stylesheet">
    <link href="https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@400;500;600;700&family=Noto+Sans+SC:wght@300;400;500;700&display=swap" rel="stylesheet">
    <script src="https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.min.js"></script>
    <style>
        body {
            font-family: 'Noto Sans SC', Tahoma, Arial, Roboto, "Droid Sans", "Helvetica Neue", "Droid Sans Fallback", "Heiti SC", "Hiragino Sans GB", Simsun, sans-serif;
            background: linear-gradient(135deg, #f5f7fa 0%, #c3cfe2 100%);
            min-height: 100vh;
        }
        
        .hero-gradient {
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
        }
        
        .card-hover {
            transition: all 0.3s ease;
        }
        
        .card-hover:hover {
            transform: translateY(-5px);
            box-shadow: 0 20px 40px rgba(0,0,0,0.1);
        }
        
        .text-gradient {
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            -webkit-background-clip: text;
            -webkit-text-fill-color: transparent;
            background-clip: text;
        }
        
        .code-block {
            background: #1e1e1e;
            color: #d4d4d4;
            border-radius: 12px;
            overflow-x: auto;
        }
        
        .code-block pre {
            margin: 0;
            padding: 1.5rem;
            font-family: 'Consolas', 'Monaco', monospace;
            font-size: 14px;
            line-height: 1.6;
        }
        
        .section-divider {
            height: 2px;
            background: linear-gradient(to right, transparent, #667eea, transparent);
            margin: 3rem 0;
        }
        
        .feature-icon {
            width: 60px;
            height: 60px;
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            border-radius: 16px;
            display: flex;
            align-items: center;
            justify-content: center;
            color: white;
            font-size: 24px;
            margin-bottom: 1rem;
        }
        
        .timeline-dot {
            width: 16px;
            height: 16px;
            background: #667eea;
            border-radius: 50%;
            position: absolute;
            left: -8px;
            top: 6px;
        }
        
        .timeline-line {
            position: absolute;
            left: 0;
            top: 0;
            bottom: 0;
            width: 2px;
            background: #e5e7eb;
        }
        
        @keyframes fadeInUp {
            from {
                opacity: 0;
                transform: translateY(30px);
            }
            to {
                opacity: 1;
                transform: translateY(0);
            }
        }
        
        .animate-fadeInUp {
            animation: fadeInUp 0.6s ease-out;
        }
        
        .highlight-box {
            background: linear-gradient(135deg, #f093fb 0%, #f5576c 100%);
            color: white;
            padding: 1.5rem;
            border-radius: 12px;
            margin: 2rem 0;
        }
        
        .data-card {
            background: white;
            border-radius: 16px;
            padding: 2rem;
            box-shadow: 0 10px 30px rgba(0,0,0,0.05);
            border: 1px solid #f3f4f6;
        }
        
        .mermaid {
            display: flex;
            justify-content: center;
            margin: 2rem 0;
        }
    </style>
</head>
<body>
    <!-- Hero Section -->
    <section class="hero-gradient text-white py-20">
        <div class="container mx-auto px-6 text-center">
            <h1 class="text-5xl md:text-6xl font-bold mb-6 animate-fadeInUp">
                双Token无感刷新
            </h1>
            <p class="text-xl md:text-2xl mb-8 opacity-90 animate-fadeInUp" style="animation-delay: 0.2s">
                让用户永不掉线的终极认证方案
            </p>
            <div class="flex justify-center space-x-8 animate-fadeInUp" style="animation-delay: 0.4s">
                <div class="text-center">
                    <i class="fas fa-shield-alt text-4xl mb-2"></i>
                    <p class="text-sm">军工级安全</p>
                </div>
                <div class="text-center">
                    <i class="fas fa-rocket text-4xl mb-2"></i>
                    <p class="text-sm">28K QPS</p>
                </div>
                <div class="text-center">
                    <i class="fas fa-users text-4xl mb-2"></i>
                    <p class="text-sm">百万并发</p>
                </div>
            </div>
        </div>
    </section>

    <!-- Main Content -->
    <main class="container mx-auto px-6 py-12 max-w-6xl">
        
        <!-- Introduction Card -->
        <div class="data-card mb-12 animate-fadeInUp">
            <div class="flex items-start space-x-4">
                <i class="fas fa-exclamation-circle text-4xl text-red-500 mt-1"></i>
                <div class="flex-1">
                    <h2 class="text-2xl font-bold mb-4 text-gray-800">痛点：登录突然失效的噩梦</h2>
                    <p class="text-lg text-gray-600 leading-relaxed mb-4">
                        每次登录突然失效，就像追剧到高潮突然插播广告——体验差到让人想摔手机！
                    </p>
                    <p class="text-gray-700">
                        我们团队用血泪教训总结出这套<span class="font-bold text-purple-600">双Token无感刷新方案</span>：
                    </p>
                    <div class="grid md:grid-cols-3 gap-4 mt-6">
                        <div class="bg-purple-50 p-4 rounded-lg">
                            <i class="fas fa-user-clock text-purple-600 text-2xl mb-2"></i>
                            <p class="text-sm">用户刷一天App都不会感知到Token刷新</p>
                        </div>
                        <div class="bg-purple-50 p-4 rounded-lg">
                            <i class="fas fa-user-secret text-purple-600 text-2xl mb-2"></i>
                            <p class="text-sm">黑客就算截获Token也毫无用处</p>
                        </div>
                        <div class="bg-purple-50 p-4 rounded-lg">
                            <i class="fas fa-server text-purple-600 text-2xl mb-2"></i>
                            <p class="text-sm">百万并发下照样稳如老狗</p>
                        </div>
                    </div>
                </div>
            </div>
        </div>

        <!-- Highlight Box -->
        <div class="highlight-box animate-fadeInUp">
            <div class="flex items-center space-x-3">
                <i class="fas fa-fire text-3xl"></i>
                <div>
                    <h3 class="text-xl font-bold mb-1">最骚的是这招</h3>
                    <p>用Redis原子操作+设备指纹绑定，把阿里云架构师都整不会了！</p>
                </div>
            </div>
        </div>

        <div class="section-divider"></div>

        <!-- Why Section -->
        <section class="mb-16">
            <h2 class="text-3xl font-bold mb-8 text-gray-800">
                <i class="fas fa-question-circle text-purple-600 mr-3"></i>
                为什么你的登录方案总被骂？
            </h2>
            
            <div class="data-card">
                <p class="text-lg text-gray-700 leading-relaxed mb-6">
                    去年我们系统上线新版本后，用户集体炸锅——刷着刷着突然跳回登录页，购物车里的限量球鞋全没了！原来单Token方案就像一张<span class="font-bold text-purple-600">纸质门票</span>，过期就得重新排队买票。而双Token方案是<span class="font-bold text-purple-600">门票+电子手环</span>组合：
                </p>
                
                <div class="grid md:grid-cols-2 gap-6">
                    <div class="bg-gradient-to-br from-purple-50 to-pink-50 p-6 rounded-xl">
                        <div class="flex items-center mb-3">
                            <i class="fas fa-ticket-alt text-purple-600 text-2xl mr-3"></i>
                            <h3 class="text-xl font-bold">Access Token（门票）</h3>
                        </div>
                        <p class="text-gray-700">短时效（2小时），用于接口访问</p>
                    </div>
                    <div class="bg-gradient-to-br from-blue-50 to-purple-50 p-6 rounded-xl">
                        <div class="flex items-center mb-3">
                            <i class="fas fa-ring text-blue-600 text-2xl mr-3"></i>
                            <h3 class="text-xl font-bold">Refresh Token（电子手环）</h3>
                        </div>
                        <p class="text-gray-700">长时效（7天），用于续期门票</p>
                    </div>
                </div>
                
                <div class="code-block mt-6">
                    <pre><code>// 典型登录响应
{
  "access_token": "eyJhbGciOiJIUz...",
  "expires_in": 7200,
  "refresh_token": "dGhpcyBpcyBh...",
  "refresh_expires": 604800
}</code></pre>
                </div>
                
                <div class="bg-yellow-50 border-l-4 border-yellow-400 p-4 mt-6">
                    <p class="text-gray-700">
                        <i class="fas fa-lightbulb text-yellow-600 mr-2"></i>
                        但你以为这就完了？我们第一次实现时，前端小哥在厕所堵我："每次刷新都要loading转圈，用户以为卡死了！" 这才明白要做<span class="font-bold">无感刷新</span>——就像迪士尼的快速通行证，玩完一个项目自动预约下一个。
                    </p>
                </div>
            </div>
        </section>

        <div class="section-divider"></div>

        <!-- Pitfalls Section -->
        <section class="mb-16">
            <h2 class="text-3xl font-bold mb-8 text-gray-800">
                <i class="fas fa-bomb text-red-500 mr-3"></i>
                这些坑你躲得过吗？
            </h2>
            
            <div class="space-y-6">
                <!-- Pitfall 1 -->
                <div class="data-card card-hover">
                    <div class="flex items-start space-x-4">
                        <div class="feature-icon">
                            <i class="fas fa-bolt"></i>
                        </div>
                        <div class="flex-1">
                            <h3 class="text-xl font-bold mb-3">1. 连环刷新风暴</h3>
                            <p class="text-gray-700 mb-4">
                                前端同时发起多个请求，每个请求发现token过期都去刷新，瞬间把服务端打爆。解决方案：用<span class="font-bold text-purple-600">Redis原子锁</span>控制刷新频率。
                            </p>
                            <div class="code-block">
                                <pre><code>// Redis加锁伪代码
String key = "refresh_lock:" + userId;
Boolean locked = redis.setIfAbsent(key, "1", 10, TimeUnit.SECONDS);
if (!locked) {
    throw new BusinessException("刷新操作进行中");
}</code></pre>
                            </div>
                        </div>
                    </div>
                </div>

                <!-- Pitfall 2 -->
                <div class="data-card card-hover">
                    <div class="flex items-start space-x-4">
                        <div class="feature-icon bg-gradient-to-br from-red-500 to-pink-500">
                            <i class="fas fa-user-ninja"></i>
                        </div>
                        <div class="flex-1">
                            <h3 class="text-xl font-bold mb-3">2. Token劫持漏洞</h3>
                            <p class="text-gray-700 mb-4">
                                Refresh Token被盗后，黑客可以无限生成新Token。后来我们给每个Refresh Token绑定设备指纹：
                            </p>
                            <div class="code-block">
                                <pre><code>String deviceFingerprint = request.getHeader("X-Device-ID");
String refreshToken = jwtTool.generateRefreshToken(userId, deviceFingerprint);</code></pre>
                            </div>
                        </div>
                    </div>
                </div>

                <!-- Pitfall 3 -->
                <div class="data-card card-hover">
                    <div class="flex items-start space-x-4">
                        <div class="feature-icon bg-gradient-to-br from-yellow-500 to-orange-500">
                            <i class="fas fa-mobile-alt"></i>
                        </div>
                        <div class="flex-1">
                            